SB2021012040 - Security restrictions bypass in Oracle Adaptive Access Manager
Published: January 20, 2021
Security Bulletin ID
SB2021012040
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Security restrictions bypass (CVE-ID: CVE-2018-2587)
The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and write arbitrary files on the target system.The weakness exists in the Oracle Access Manager Web Server Plugin component due to improper security restrictions. A remote attacker can create, delete or modify critical data or all Oracle Access Manager accessible data and read a subset of Oracle Access Manager accessible data.
Remediation
Install update from vendor's website.